ECMP Single Interface

[dustin.campbell]

I have an HA pair of firewalls in my data center. I have a single ISP that provides two routers for internet access. I use HSRP on those routers, which obviously share the same subnet on the inside interface that connects to the outside interface of the Palo Alto firewalls. I have two instances of HSRP setup to where some of my other perimeter devices can use ISP router A and the Palo Alto can use ISP router B. I'd like to get the Palo Alto to use both router A and B though. Can I add an additional default route to the virtual router that uses the other router's HSRP IP and then enable ECMP? I would have two default routes on the same virtual router; one going to router A's HSRP IP and one going to router B's HSRP IP. 

I can't seem to find any examples of using ECMP via a single interface. All examples are when you have two separate interfaces that you want to route out of. Would this setup work? 

[TomYoung]

Hi @dustin.campbell ,

I don't see why it wouldn't work.  ECMP will allow for multiple routes to the same destination.  I doubt it does an interface check except to verify it is a L3 interface.  Follow the dual-interface example, but point your 2 routes to the same interface.

Check your routing table (Network > Virtual Routers > More Runtime Stats) to verify both routes are present.  You could even configure path monitoring for your static routes for automatic failover.  https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/static-routes/configure-path-m...

Thanks,

Tom